The Stored Process Server authenticates client users through host authentication. So, if you use an alternative authentication provider, such as LDAP or Microsoft Active Directory, each client user must also have a host account for the SAS Stored Process Server machine or be a member of a metadata group that has a valid host account login. Authentication domains are used to determine which login account will be used by the SAS Stored Process Server for single-signon security.

Consider the following example:

1. A user named Bob Smith has an LDAP account called bobsmith@abc.
2. Bob Smith does not have a valid host account on the SAS Stored Process Server machine. So, you must create a metadata group that has a login account that is a valid host account on the SAS Stored Process Server machine. Bob must be a member of this group.
3. For example, the group might be called STPUSERS and the host login account might be stpuser1.
4. The stpuser1 user account (the login account for STPUSERS) must be in the same Authentication Domain as the SAS Stored Process Server. For example:

        Authentication Domain: DefaultAuth       
        User ID:               stpuser1
   
   

In this example, the SAS Stored Process Server is also in the DefaultAuth Authentication Domain.
5. The LDAP account must be in a Authentication Domain that is different than the Authentication Domain that is associated with the SAS Stored Process Server. For example:

        Authentication Domain: LDAPAuth       
        User ID:               bobsmith@abc
   

Here is a summary of the sequence of events that occurs when Bob Smith logs on to the client and executes a stored process.

1. Bob logs on to the client application (for example, SAS^® Enterprise Guide^®) using his LDAP user account bobsmith@abc.
2. Bob executes a stored process.
3. The client (SAS Enterprise Guide) accesses the SAS^® Metadata Server and requests a user login account for Bob Smith that is associated with the SAS Stored Process Server's Authentication Domain (DefaultAuth).

   Bob Smith is a member of the STPUSERS group that has a login account called stpuser1 that is associated with DefaultAuth. So, stpuser1 is the user account that is passed by the client (SAS Enterprise Guide) to the SAS Stored Process Server for user authentication.

4. The SAS Stored Process Server successfully authenticates the user using the stpuser1 account. Then, the SAS Stored Process Server executes the request.

Note: If Bob Smith is a member of multiple metadata groups and each group has a login account for DefaultAuth, then one of the login accounts will be used for the SAS Stored Process Server request (but, it is not possible to predict which login account will be used).

Operating System and Release Information

Product Family	Product	System	SAS Release
			Reported	Fixed*
SAS System	SAS Integration Technologies	Microsoft® Windows® for 64-Bit Itanium-based Systems	9.1 TS1M3 SP1
		Microsoft Windows Server 2003 Datacenter 64-bit Edition	9.1 TS1M3 SP1
		Microsoft Windows Server 2003 Enterprise 64-bit Edition	9.1 TS1M3 SP1
		Microsoft Windows XP 64-bit Edition	9.1 TS1M3 SP1
		Microsoft® Windows® for x64	9.1 TS1M3 SP1
		Microsoft Windows 2000 Advanced Server	9.1 TS1M3 SP1
		Microsoft Windows 2000 Datacenter Server	9.1 TS1M3 SP1
		Microsoft Windows 2000 Server	9.1 TS1M3 SP1
		Microsoft Windows 2000 Professional	9.1 TS1M3 SP1
		Microsoft Windows NT Workstation	9.1 TS1M3 SP1
		Microsoft Windows Server 2003 Datacenter Edition	9.1 TS1M3 SP1
		Microsoft Windows Server 2003 Enterprise Edition	9.1 TS1M3 SP1
		Microsoft Windows Server 2003 Standard Edition	9.1 TS1M3 SP1
		Microsoft Windows XP Professional	9.1 TS1M3 SP1
		Windows Vista	9.1 TS1M3 SP1
		64-bit Enabled AIX	9.1 TS1M3 SP1
		64-bit Enabled HP-UX	9.1 TS1M3 SP1
		64-bit Enabled Solaris	9.1 TS1M3 SP1
		HP-UX IPF	9.1 TS1M3 SP1
		Linux	9.1 TS1M3 SP1
		OpenVMS Alpha	9.1 TS1M3 SP1
		Tru64 UNIX	9.1 TS1M3 SP1

* For software releases that are not yet generally available, the Fixed Release is the software release in which the problem is planned to be fixed.

---

The SAS Stored Process Server authenticates client users through host authentication. So, if you use an LDAP account when logging on to the client, you must also have a host account on the SAS Stored Process Server machine or be a member of a metadata group that has a login host account.

Type:	Usage Note
Priority:

Date Modified:	2007-12-14 14:59:33
Date Created:	2007-11-08 17:30:44